COSINE LDAP/X.500 Schema
Extracted elements (24)
RFC 1274's caseIgnoreIA5StringSyntax was replaced with the standard IA5String syntax and appropriate matching rules in 'mail' and 'associatedDomain', aligning with modern LDAP syntax definitions in RFC 4517.
The 'pilotObject' and 'pilotPerson' object classes from RFC 1274 were not brought forward because their functions are largely replaced by operational attributes in X.500(93) and LDAPv3 (e.g., creatorsName, modifyTimestamp replacing lastModifiedBy/lastModifiedTime) and by 'organizationalPerson' subclasses like 'inetOrgPerson'.
Some implementations may recognize COSINE attribute types by their X.500 names (e.g., favoriteDrink, friendCountryName, homeTelephoneNumber) for legacy reasons; the X.500 names have been reserved in IANA as historic solely for this backward-compatibility purpose.
The COSINE 'uniqueIdentifier' (OID 0.9.2342.19200300.100.1.44) must not be confused with X.520's 'uniqueIdentifier' (OID 2.5.4.45), which is called 'x500UniqueIdentifier' in LDAP (RFC 4519).
The 'mail' attribute uses caseIgnoreIA5Match, which differs from normal Mailbox comparison rules: the assertion (mail=joe@example.com) will match 'JOE@example.com', and two mailboxes differing only in local-part case cannot both be stored as they are considered equal.
Applications supporting internationalized domain names SHALL use the ToASCII method (RFC 3490) to produce sub-domain components of the Mailbox production stored in the 'mail' attribute.
Directory administrators and application designers SHOULD consider carefully the distinctions between 'organizationalStatus', 'title', and 'userClass' attributes when modeling person categories.
The 'cn' (commonName) attribute type SHOULD be used for naming room objects of the 'room' object class.
The 'uid' attribute SHOULD be used for naming entries of the 'account' object class.
The 'account' object class (OID 0.9.2342.19200300.100.4.5) is a STRUCTURAL class for computer account entries, requiring 'uid' and optionally allowing description, seeAlso, l, o, ou, and host attributes.
The 'associatedDomain' attribute (OID 0.9.2342.19200300.100.1.37) specifies DNS host names associated with an object, using IA5String syntax with caseIgnoreIA5Match equality and caseIgnoreIA5SubstringsMatch substring matching rules.
The 'co' (Friendly Country Name) attribute (OID 0.9.2342.19200300.100.1.43) specifies human-readable country names (e.g., 'Germany', 'Federal Republic of Germany') using DirectoryString syntax with caseIgnoreMatch equality.
The 'document' object class (OID 0.9.2342.19200300.100.4.6) is a STRUCTURAL class for document entries, requiring 'documentIdentifier' and optionally allowing cn, description, seeAlso, l, o, ou, documentTitle, documentVersion, documentAuthor, documentLocation, and documentPublisher.
The 'documentSeries' object class (OID 0.9.2342.19200300.100.4.9) is a STRUCTURAL class for entries representing series of documents (e.g., RFC memos), requiring 'cn' and optionally allowing description, l, o, ou, seeAlso, and telephoneNumber.
The 'domain' object class (OID 0.9.2342.19200300.100.4.13) is a STRUCTURAL class for DNS domain entries that are not organizations or organizational units, requiring 'dc' with an extensive list of optional attributes including associatedName.
The 'domainRelatedObject' object class (OID 0.9.2342.19200300.100.4.17) is an AUXILIARY class that links entries representing DNS domains 'equivalent' to X.500 domains, requiring the 'associatedDomain' attribute.
The 'friendlyCountry' object class (OID 0.9.2342.19200300.100.4.18) is a STRUCTURAL subclass of 'country' that requires the 'co' attribute, enabling human-readable country names beyond the two-letter ISO 3166 codes.
The 'homePhone' attribute (OID 0.9.2342.19200300.100.1.20) specifies home telephone numbers using telephoneNumber syntax (1.3.6.1.4.1.1466.115.121.1.50) with telephoneNumberMatch equality and telephoneNumberSubstringsMatch substring rules.
The 'mail' (rfc822mailbox) attribute (OID 0.9.2342.19200300.100.1.3) holds Internet mail addresses in Mailbox form, using IA5String syntax (max 256 chars) with caseIgnoreIA5Match equality matching.
The 'rFC822LocalPart' object class (OID 0.9.2342.19200300.100.4.14) is a STRUCTURAL subclass of 'domain' representing the local part of Internet mail addresses, treating it as a domain object with additional optional person-related attributes.
The 'simpleSecurityObject' object class (OID 0.9.2342.19200300.100.4.19) is an AUXILIARY class used to require a 'userPassword' attribute on entries whose structural object class does not already require or allow it.
The 'uniqueIdentifier' attribute (OID 0.9.2342.19200300.100.1.44) specifies a locally scoped unique identifier for a directory object (e.g., payroll number for a person, department code for an OU), using DirectoryString syntax (max 256 chars).
IANA updated the LDAP descriptors registry (RFC 4520) to associate 25 attribute type descriptors and 9 object class descriptors with RFC 4524, including marking several legacy names (favouriteDrink, friendlyCountryName, homeTelephone, mobileTelephoneNumber, pagerTelephoneNumber, rfc822Mailbox) as historic.
Directory administrators should restrict access to sensitive information to authorized entities and use data integrity and confidentiality services to protect against eavesdropping. Simple authentication (plain text passwords) should only be used when adequate data security services are in place.